@naulon/shared 0.0.1

package/dist/attribution.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Attribution-as-settlement: turn an article's credits graph into a flat list
+ * of (wallet, share) payees. Co-authors can be composites that re-split among
+ * their own members, so resolution is recursive. Shares always sum to 1.
+ *
+ * This is the "recursive co-author splits read from the credits graph" that the
+ * innovation axis rewards — the payout rule is the attribution metadata itself.
+ */
+import type { ArticleCredits, AuthorShare, Contributor, WalletAddress } from "./types.ts";
+/**
+ * Flatten an article's credits into payees. The same author appearing in
+ * multiple subtrees is merged into a single payee (shares added) so settlement
+ * is one transfer per wallet, not one per graph edge.
+ */
+export declare function resolvePayees(credits: ArticleCredits): AuthorShare[];
+/**
+ * Tie-break for choosing the single on-chain recipient when two payees hold an
+ * equal top share. `"wallet"` (default) breaks ties lexicographically by address,
+ * so the recipient is a pure function of *who is credited* — independent of the
+ * order the credits graph happened to list them in (a reordered or swapped credits
+ * endpoint can't change who receives the on-chain leg). `"input"` keeps the
+ * credits-graph order (stable sort), matching the pre-config behavior.
+ */
+export type TieBreak = "wallet" | "input";
+/**
+ * The single on-chain recipient for a toll: the highest-share payee. x402 settles
+ * to one `payTo`, and the settlement record flags this same wallet `primary`, so
+ * the on-chain leg and the recorded split MUST agree on it. This is the one source
+ * of that choice — imported by the x402 requirement builder and the settlement-body
+ * builder rather than computed twice. Throws on an empty payee list: a tolled event
+ * always has ≥1 payee, so empty is a malformed call, not a routing edge to paper over.
+ */
+export declare function primaryPayee(payees: AuthorShare[], tieBreak?: TieBreak): WalletAddress;
+/** Integer micro-USDC allocation for one payee — the dust-free unit of truth. */
+export interface MicroAllocation {
+    wallet: WalletAddress;
+    authorId: string;
+    micro: number;
+}
+/**
+ * Split an integer micro-USDC total across payees by share. Distributes whole
+ * micro units and hands any rounding remainder to the largest-share payee(s),
+ * so `Σ micro === totalMicro` exactly — no dust created or lost. This is the
+ * money-truth core: callers that need floats wrap it (splitAmount); callers
+ * that report integer micro-units to a publisher (settlementEmit) use it raw,
+ * never re-multiplying a float back up (which could break a strict sum check).
+ */
+export declare function splitMicro(totalMicro: number, payees: AuthorShare[]): MicroAllocation[];
+/**
+ * Split a concrete toll amount across payees. Distributes whole micro-USDC
+ * units (6 decimals) and assigns any rounding remainder to the largest payee,
+ * so the sum of payouts exactly equals the toll — no dust created or lost.
+ */
+export declare function splitAmount(amountUsdc: number, payees: AuthorShare[]): {
+    wallet: WalletAddress;
+    authorId: string;
+    amountUsdc: number;
+}[];
+/**
+ * A custody-free split of the author price into on-chain settlement legs: ONE
+ * primary leg (settled synchronously at the gate — it gates the content) plus one
+ * deferred leg per OTHER co-author. Every leg is a DIRECT buyer→author transfer, so
+ * no wallet ever receives money owed to a different author — the lead is never a
+ * custodian of a co-author's cut (the custody-free / money-transmitter line).
+ */
+export interface AuthorLegSplit {
+    /** The highest-share payee — recipient of the synchronous, content-gating leg. */
+    primaryPayTo: WalletAddress;
+    /** The primary author's cut. Atomic micro-USDC, integer string. */
+    primaryAmountMicro: string;
+    /** One deferred leg per other co-author (a cut that floors to 0 micro is dropped). */
+    coauthorLegs: {
+        payTo: WalletAddress;
+        amountMicro: string;
+    }[];
+}
+/**
+ * Split `atomicPrice` (integer micro-USDC) across `payees` into legs for
+ * split-at-source on-chain settlement. Reuses `splitMicro` so Σ(every leg) ===
+ * atomicPrice EXACTLY (no dust created or lost) AND the leg amounts match the
+ * earnings-ledger split byte-for-byte — so a co-author's on-chain *paid* equals
+ * their ledger *owed*, and reconciliation never shows phantom drift. The primary is
+ * `primaryPayee`, the same wallet the requirement builder and the settlement record
+ * already agree on. A single payee yields no co-author legs and a primary leg of the
+ * whole price (the stock single-author toll). A co-author cut that floors to 0 micro
+ * is dropped — a 0-amount transfer is meaningless and the facilitator would reject
+ * it; the sum still holds because `splitMicro` handed those units to the primary.
+ */
+export declare function splitAuthorLegs(payees: AuthorShare[], atomicPrice: number, tieBreak?: TieBreak): AuthorLegSplit;
+/** Convenience for tests / fixtures: build a leaf contributor. */
+export declare function author(authorId: string, wallet: string, weight?: number): Contributor;
+//# sourceMappingURL=attribution.d.ts.map

package/dist/attribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribution.d.ts","sourceRoot":"","sources":["../src/attribution.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAiC1F;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,WAAW,EAAE,CAmBpE;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE1C;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,GAAE,QAAmB,GAAG,aAAa,CAUhG;AAID,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAmBvF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,WAAW,EAAE,GACpB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAE,CAMnE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,kFAAkF;IAClF,YAAY,EAAE,aAAa,CAAC;IAC5B,mEAAmE;IACnE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sFAAsF;IACtF,YAAY,EAAE;QAAE,KAAK,EAAE,aAAa,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,EAAE,EACrB,WAAW,EAAE,MAAM,EACnB,QAAQ,GAAE,QAAmB,GAC5B,cAAc,CAahB;AAED,kEAAkE;AAClE,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,WAAW,CAErF"}

package/dist/attribution.js

@@ -0,0 +1,145 @@
+import { walletAddress } from "./types.js";
+const EPSILON = 1e-9;
+/**
+ * Resolve a credits graph into normalized author shares.
+ *
+ * @param parentShare the fraction of the whole toll flowing into this subtree
+ *                    (1 at the root).
+ */
+function resolveContributors(contributors, parentShare) {
+    const totalWeight = contributors.reduce((sum, c) => sum + (c.weight ?? 1), 0);
+    if (totalWeight <= 0) {
+        throw new Error("contributor weights sum to zero — cannot split");
+    }
+    const out = [];
+    for (const c of contributors) {
+        const localShare = ((c.weight ?? 1) / totalWeight) * parentShare;
+        if (c.members && c.members.length > 0) {
+            // Composite contributor: recurse, passing down its slice of the toll.
+            out.push(...resolveContributors(c.members, localShare));
+        }
+        else if (c.wallet) {
+            out.push({ authorId: c.authorId, wallet: c.wallet, share: localShare });
+        }
+        else {
+            throw new Error(`contributor ${c.authorId} has neither wallet nor members`);
+        }
+    }
+    return out;
+}
+/**
+ * Flatten an article's credits into payees. The same author appearing in
+ * multiple subtrees is merged into a single payee (shares added) so settlement
+ * is one transfer per wallet, not one per graph edge.
+ */
+export function resolvePayees(credits) {
+    const raw = resolveContributors(credits.contributors, 1);
+    const byWallet = new Map();
+    for (const r of raw) {
+        const existing = byWallet.get(r.wallet);
+        if (existing) {
+            existing.share += r.share;
+        }
+        else {
+            byWallet.set(r.wallet, { ...r });
+        }
+    }
+    const merged = [...byWallet.values()];
+    const sum = merged.reduce((s, p) => s + p.share, 0);
+    if (Math.abs(sum - 1) > EPSILON) {
+        throw new Error(`shares sum to ${sum}, expected 1 — credits graph is malformed`);
+    }
+    return merged;
+}
+/**
+ * The single on-chain recipient for a toll: the highest-share payee. x402 settles
+ * to one `payTo`, and the settlement record flags this same wallet `primary`, so
+ * the on-chain leg and the recorded split MUST agree on it. This is the one source
+ * of that choice — imported by the x402 requirement builder and the settlement-body
+ * builder rather than computed twice. Throws on an empty payee list: a tolled event
+ * always has ≥1 payee, so empty is a malformed call, not a routing edge to paper over.
+ */
+export function primaryPayee(payees, tieBreak = "wallet") {
+    if (payees.length === 0) {
+        throw new Error("no payees — cannot resolve a primary on-chain recipient");
+    }
+    const sorted = [...payees].sort((a, b) => {
+        if (b.share !== a.share)
+            return b.share - a.share;
+        if (tieBreak === "wallet")
+            return a.wallet < b.wallet ? -1 : a.wallet > b.wallet ? 1 : 0;
+        return 0; // "input": stable sort preserves the credits-graph order
+    });
+    return sorted[0].wallet;
+}
+const MICRO = 1_000_000; // USDC has 6 decimals
+/**
+ * Split an integer micro-USDC total across payees by share. Distributes whole
+ * micro units and hands any rounding remainder to the largest-share payee(s),
+ * so `Σ micro === totalMicro` exactly — no dust created or lost. This is the
+ * money-truth core: callers that need floats wrap it (splitAmount); callers
+ * that report integer micro-units to a publisher (settlementEmit) use it raw,
+ * never re-multiplying a float back up (which could break a strict sum check).
+ */
+export function splitMicro(totalMicro, payees) {
+    const allocations = payees.map((p) => ({
+        wallet: p.wallet,
+        authorId: p.authorId,
+        micro: Math.floor(totalMicro * p.share),
+    }));
+    const assigned = allocations.reduce((s, a) => s + a.micro, 0);
+    let remainder = totalMicro - assigned;
+    // Hand the rounding remainder to the largest-share payee(s), deterministically.
+    const order = [...allocations].sort((a, b) => b.micro - a.micro);
+    let i = 0;
+    while (remainder > 0 && order.length > 0) {
+        order[i % order.length].micro += 1;
+        remainder--;
+        i++;
+    }
+    return allocations;
+}
+/**
+ * Split a concrete toll amount across payees. Distributes whole micro-USDC
+ * units (6 decimals) and assigns any rounding remainder to the largest payee,
+ * so the sum of payouts exactly equals the toll — no dust created or lost.
+ */
+export function splitAmount(amountUsdc, payees) {
+    return splitMicro(Math.round(amountUsdc * MICRO), payees).map((a) => ({
+        wallet: a.wallet,
+        authorId: a.authorId,
+        amountUsdc: a.micro / MICRO,
+    }));
+}
+/**
+ * Split `atomicPrice` (integer micro-USDC) across `payees` into legs for
+ * split-at-source on-chain settlement. Reuses `splitMicro` so Σ(every leg) ===
+ * atomicPrice EXACTLY (no dust created or lost) AND the leg amounts match the
+ * earnings-ledger split byte-for-byte — so a co-author's on-chain *paid* equals
+ * their ledger *owed*, and reconciliation never shows phantom drift. The primary is
+ * `primaryPayee`, the same wallet the requirement builder and the settlement record
+ * already agree on. A single payee yields no co-author legs and a primary leg of the
+ * whole price (the stock single-author toll). A co-author cut that floors to 0 micro
+ * is dropped — a 0-amount transfer is meaningless and the facilitator would reject
+ * it; the sum still holds because `splitMicro` handed those units to the primary.
+ */
+export function splitAuthorLegs(payees, atomicPrice, tieBreak = "wallet") {
+    const primary = primaryPayee(payees, tieBreak);
+    const allocations = splitMicro(atomicPrice, payees);
+    let primaryAmountMicro = "0";
+    const coauthorLegs = [];
+    for (const a of allocations) {
+        if (a.wallet === primary) {
+            primaryAmountMicro = String(a.micro);
+        }
+        else if (a.micro > 0) {
+            coauthorLegs.push({ payTo: a.wallet, amountMicro: String(a.micro) });
+        }
+    }
+    return { primaryPayTo: primary, primaryAmountMicro, coauthorLegs };
+}
+/** Convenience for tests / fixtures: build a leaf contributor. */
+export function author(authorId, wallet, weight) {
+    return { authorId, wallet: walletAddress(wallet), weight };
+}
+//# sourceMappingURL=attribution.js.map

package/dist/attribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribution.js","sourceRoot":"","sources":["../src/attribution.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,OAAO,GAAG,IAAI,CAAC;AAErB;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,YAA2B,EAAE,WAAmB;IAC3E,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,WAAW,CAAC,GAAG,WAAW,CAAC;QAEjE,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,sEAAsE;YACtE,GAAG,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,iCAAiC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,2CAA2C,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,MAAqB,EAAE,WAAqB,QAAQ;IAC/E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAClD,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC,CAAC,yDAAyD;IACrE,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;AAC3B,CAAC;AAED,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,sBAAsB;AAS/C;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,UAAkB,EAAE,MAAqB;IAClE,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC,CAAC;IAEJ,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9D,IAAI,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IAEtC,gFAAgF;IAChF,MAAM,KAAK,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,SAAS,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAE,CAAC,KAAK,IAAI,CAAC,CAAC;QACpC,SAAS,EAAE,CAAC;QACZ,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,UAAkB,EAClB,MAAqB;IAErB,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,UAAU,EAAE,CAAC,CAAC,KAAK,GAAG,KAAK;KAC5B,CAAC,CAAC,CAAC;AACN,CAAC;AAkBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAqB,EACrB,WAAmB,EACnB,WAAqB,QAAQ;IAE7B,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,kBAAkB,GAAG,GAAG,CAAC;IAC7B,MAAM,YAAY,GAAoD,EAAE,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACzB,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACvB,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC;AACrE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,MAAM,CAAC,QAAgB,EAAE,MAAc,EAAE,MAAe;IACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;AAC7D,CAAC"}

package/dist/botAuthSign.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Web Bot Auth — the SIGNING side of RFC 9421 HTTP Message Signatures, scoped
+ * to the web-bot-auth profile the tollgate's verifier (tollgate/botAuth.ts)
+ * enforces. This is the toll's own species signing its species marker: the
+ * wayfarer stamps outbound requests with a verifiable identity, and the gate
+ * serves (and self-signs) the key directory that identity points at.
+ *
+ * Lives in shared because both ends consume it — the wayfarer (sign requests)
+ * and the tollgate (serve the directory) — and neither may depend on the other.
+ * Self-contained on node:crypto, mirroring the verifier's zero-dep stance.
+ */
+import { type KeyObject } from "node:crypto";
+/** Where every Web Bot Auth key directory lives (the drafts' well-known path). */
+export declare const BOT_AUTH_DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
+export declare const BOT_AUTH_DIRECTORY_CONTENT_TYPE = "application/http-message-signatures-directory+json";
+/** A usable Ed25519 signing identity: the private key plus the public half in
+ *  the two forms the protocol needs (raw JWK x, RFC 7638 thumbprint keyid). */
+export interface BotAuthKey {
+    privateKey: KeyObject;
+    /** Base64url raw public key — the JWK `x` member the directory publishes. */
+    x: string;
+    /** RFC 7638 JWK thumbprint — the `keyid` every signature carries. */
+    keyid: string;
+}
+/** RFC 7638 thumbprint of an Ed25519 public JWK: SHA-256 over the required
+ *  members in lexicographic order (crv, kty, x). Byte-compatible with the
+ *  verifier's jwkThumbprint — the round-trip test pins that. */
+export declare function botAuthThumbprint(x: string): string;
+/**
+ * Materialize the signing identity from a base64url 32-byte Ed25519 seed (the
+ * `BOT_AUTH_SIGNING_KEY` env). Throws on a malformed seed — the seed is
+ * operator config, and config fails loud (AGENTS.md), never silently unsigned.
+ */
+export declare function botAuthKeyFromSeed(seedB64url: string): BotAuthKey;
+/** The three headers a signing agent attaches (lowercase names, ready to merge
+ *  into a fetch). `signature-agent` is present only for the request profile —
+ *  a directory response identifies itself by being AT the well-known URL. */
+export interface BotAuthSignedHeaders {
+    "signature-input": string;
+    signature: string;
+    "signature-agent"?: string;
+}
+interface SignParams {
+    key: BotAuthKey;
+    /** The `@authority` the signature covers — the host:port the request targets. */
+    authority: string;
+    tag: "web-bot-auth" | "http-message-signatures-directory";
+    /** Signature-Agent value (request profile only): the directory host, e.g.
+     *  "naulon.app", or an http://127.0.0.1:port fixture under the gate's
+     *  BOT_AUTH_ALLOW_HTTP test flag. */
+    agent?: string;
+    createdSec?: number;
+    validitySec?: number;
+    label?: string;
+}
+/**
+ * Build + sign the RFC 9421 headers for one request (or directory response).
+ * Covered components: `("@authority")` — the CF operational profile's minimum,
+ * which is also what deployed signers (chatgpt.com) cover. The signature base
+ * reuses the exact Signature-Input member text, so signer and verifier agree
+ * byte-for-byte by construction.
+ */
+export declare function signBotAuth(params: SignParams): BotAuthSignedHeaders;
+/** The directory body: a JWKS of our Ed25519 key(s). Minimal by design — the
+ *  verifier reads kty/crv/x and ignores everything else. */
+export declare function botAuthDirectoryBody(key: BotAuthKey): string;
+/**
+ * Sign a directory RESPONSE (tag="http-message-signatures-directory") — the
+ * spec's binding of the published keys to the serving host. `authority` is the
+ * Host the client dialed; a verifier rebuilds the base from the URL it fetched.
+ */
+export declare function signBotAuthDirectory(key: BotAuthKey, authority: string, createdSec?: number): BotAuthSignedHeaders;
+export {};
+//# sourceMappingURL=botAuthSign.d.ts.map

package/dist/botAuthSign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"botAuthSign.d.ts","sourceRoot":"","sources":["../src/botAuthSign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAqE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAEhH,kFAAkF;AAClF,eAAO,MAAM,uBAAuB,mDAAmD,CAAC;AACxF,eAAO,MAAM,+BAA+B,uDAAuD,CAAC;AAMpG;+EAC+E;AAC/E,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,SAAS,CAAC;IACtB,6EAA6E;IAC7E,CAAC,EAAE,MAAM,CAAC;IACV,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;gEAEgE;AAChE,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAInD;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAejE;AAED;;6EAE6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,UAAU;IAClB,GAAG,EAAE,UAAU,CAAC;IAChB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,cAAc,GAAG,mCAAmC,CAAC;IAC1D;;yCAEqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,oBAAoB,CAepE;AAED;4DAC4D;AAC5D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,oBAAoB,CAIlH"}

package/dist/botAuthSign.js

@@ -0,0 +1,90 @@
+/**
+ * Web Bot Auth — the SIGNING side of RFC 9421 HTTP Message Signatures, scoped
+ * to the web-bot-auth profile the tollgate's verifier (tollgate/botAuth.ts)
+ * enforces. This is the toll's own species signing its species marker: the
+ * wayfarer stamps outbound requests with a verifiable identity, and the gate
+ * serves (and self-signs) the key directory that identity points at.
+ *
+ * Lives in shared because both ends consume it — the wayfarer (sign requests)
+ * and the tollgate (serve the directory) — and neither may depend on the other.
+ * Self-contained on node:crypto, mirroring the verifier's zero-dep stance.
+ */
+import { createHash, createPrivateKey, createPublicKey, sign as cryptoSign } from "node:crypto";
+/** Where every Web Bot Auth key directory lives (the drafts' well-known path). */
+export const BOT_AUTH_DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
+export const BOT_AUTH_DIRECTORY_CONTENT_TYPE = "application/http-message-signatures-directory+json";
+/** Default request-signature validity. CF's operational profile recommends ~1
+ *  minute; the draft caps acceptance at 24h. Short = small replay window. */
+const DEFAULT_VALIDITY_SEC = 60;
+/** RFC 7638 thumbprint of an Ed25519 public JWK: SHA-256 over the required
+ *  members in lexicographic order (crv, kty, x). Byte-compatible with the
+ *  verifier's jwkThumbprint — the round-trip test pins that. */
+export function botAuthThumbprint(x) {
+    return createHash("sha256")
+        .update(JSON.stringify({ crv: "Ed25519", kty: "OKP", x }))
+        .digest("base64url");
+}
+/** PKCS#8 DER prefix for a raw Ed25519 32-byte seed (RFC 8410 structure with
+ *  fixed lengths — the seed is always exactly 32 bytes). */
+const ED25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+/**
+ * Materialize the signing identity from a base64url 32-byte Ed25519 seed (the
+ * `BOT_AUTH_SIGNING_KEY` env). Throws on a malformed seed — the seed is
+ * operator config, and config fails loud (AGENTS.md), never silently unsigned.
+ */
+export function botAuthKeyFromSeed(seedB64url) {
+    const seed = Buffer.from(seedB64url, "base64url");
+    if (seed.length !== 32) {
+        throw new Error(`BOT_AUTH_SIGNING_KEY must be a base64url 32-byte Ed25519 seed (got ${seed.length} bytes) — generate one with scripts/wba-keygen.mjs`);
+    }
+    const privateKey = createPrivateKey({
+        key: Buffer.concat([ED25519_PKCS8_PREFIX, seed]),
+        format: "der",
+        type: "pkcs8",
+    });
+    const jwk = createPublicKey(privateKey).export({ format: "jwk" });
+    if (typeof jwk.x !== "string")
+        throw new Error("failed to derive the Ed25519 public key from the seed");
+    return { privateKey, x: jwk.x, keyid: botAuthThumbprint(jwk.x) };
+}
+/**
+ * Build + sign the RFC 9421 headers for one request (or directory response).
+ * Covered components: `("@authority")` — the CF operational profile's minimum,
+ * which is also what deployed signers (chatgpt.com) cover. The signature base
+ * reuses the exact Signature-Input member text, so signer and verifier agree
+ * byte-for-byte by construction.
+ */
+export function signBotAuth(params) {
+    const created = params.createdSec ?? Math.floor(Date.now() / 1000);
+    const expires = created + (params.validitySec ?? DEFAULT_VALIDITY_SEC);
+    const label = params.label ?? "sig1";
+    const member = `("@authority");created=${created};expires=${expires};keyid="${params.key.keyid}";tag="${params.tag}"`;
+    const base = `"@authority": ${params.authority.toLowerCase()}\n"@signature-params": ${member}`;
+    const sig = cryptoSign(null, Buffer.from(base, "utf8"), params.key.privateKey).toString("base64");
+    const headers = {
+        "signature-input": `${label}=${member}`,
+        signature: `${label}=:${sig}:`,
+    };
+    // CF profile: Signature-Agent MUST be a plain quoted string (rev-00's
+    // dictionary form is rejected by deployed verifiers).
+    if (params.agent !== undefined)
+        headers["signature-agent"] = `"${params.agent}"`;
+    return headers;
+}
+/** The directory body: a JWKS of our Ed25519 key(s). Minimal by design — the
+ *  verifier reads kty/crv/x and ignores everything else. */
+export function botAuthDirectoryBody(key) {
+    return JSON.stringify({ keys: [{ kty: "OKP", crv: "Ed25519", x: key.x }] });
+}
+/**
+ * Sign a directory RESPONSE (tag="http-message-signatures-directory") — the
+ * spec's binding of the published keys to the serving host. `authority` is the
+ * Host the client dialed; a verifier rebuilds the base from the URL it fetched.
+ */
+export function signBotAuthDirectory(key, authority, createdSec) {
+    const params = { key, authority, tag: "http-message-signatures-directory", validitySec: 300 };
+    if (createdSec !== undefined)
+        params.createdSec = createdSec;
+    return signBotAuth(params);
+}
+//# sourceMappingURL=botAuthSign.js.map

package/dist/botAuthSign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"botAuthSign.js","sourceRoot":"","sources":["../src/botAuthSign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,UAAU,EAAkB,MAAM,aAAa,CAAC;AAEhH,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAAG,gDAAgD,CAAC;AACxF,MAAM,CAAC,MAAM,+BAA+B,GAAG,oDAAoD,CAAC;AAEpG;6EAC6E;AAC7E,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAYhC;;gEAEgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;SACzD,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED;4DAC4D;AAC5D,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;AAEpF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,sEAAsE,IAAI,CAAC,MAAM,oDAAoD,CACtI,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAmB,CAAC;IACpF,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACxG,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC;AAyBD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAAkB;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC;IACrC,MAAM,MAAM,GAAG,0BAA0B,OAAO,YAAY,OAAO,WAAW,MAAM,CAAC,GAAG,CAAC,KAAK,UAAU,MAAM,CAAC,GAAG,GAAG,CAAC;IACtH,MAAM,IAAI,GAAG,iBAAiB,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,0BAA0B,MAAM,EAAE,CAAC;IAC/F,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClG,MAAM,OAAO,GAAyB;QACpC,iBAAiB,EAAE,GAAG,KAAK,IAAI,MAAM,EAAE;QACvC,SAAS,EAAE,GAAG,KAAK,KAAK,GAAG,GAAG;KAC/B,CAAC;IACF,sEAAsE;IACtE,sDAAsD;IACtD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC;IACjF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;4DAC4D;AAC5D,MAAM,UAAU,oBAAoB,CAAC,GAAe;IAClD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAe,EAAE,SAAiB,EAAE,UAAmB;IAC1F,MAAM,MAAM,GAAe,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,mCAAmC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IAC1G,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;IAC7D,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,131 @@
+import { z } from "zod";
+export declare const configSchema: z.ZodObject<{
+    PAYMENT_MODE: z.ZodDefault<z.ZodEnum<{
+        mock: "mock";
+        gateway: "gateway";
+    }>>;
+    SETTLEMENT_NETWORK: z.ZodDefault<z.ZodEnum<{
+        arcTestnet: "arcTestnet";
+        baseSepolia: "baseSepolia";
+        base: "base";
+    }>>;
+    CIRCLE_API_KEY: z.ZodOptional<z.ZodString>;
+    GATEWAY_API_URL: z.ZodOptional<z.ZodString>;
+    RELAYER_PRIVATE_KEY: z.ZodOptional<z.ZodString>;
+    USDC_EIP712_NAME: z.ZodOptional<z.ZodString>;
+    X402_MAX_TIMEOUT_SECONDS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    TOLLGATE_PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ORIGIN_URL: z.ZodDefault<z.ZodString>;
+    DEFAULT_PRICE_USDC: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    CITATION_MULTIPLIER: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ARTICLE_PATH_PREFIXES: z.ZodDefault<z.ZodString>;
+    TOLLGATE_SECRET: z.ZodOptional<z.ZodString>;
+    NONCE_TTL_SECONDS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    RATE_LIMIT_RPM: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    RATE_LIMIT_BURST: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    TRUST_PROXY: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "true" | "false">>;
+    BOT_AUTH_ALLOW_HTTP: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "true" | "false">>;
+    BOT_AUTH_SIGNING_KEY: z.ZodOptional<z.ZodString>;
+    BOT_AUTH_SIGNATURE_AGENT: z.ZodOptional<z.ZodString>;
+    CREDITS_API_URL: z.ZodOptional<z.ZodString>;
+    CREDITS_API_TOKEN: z.ZodOptional<z.ZodString>;
+    CREDITS_FIXTURES: z.ZodDefault<z.ZodString>;
+    CREDITS_SETTLEMENT_SECRET: z.ZodOptional<z.ZodString>;
+    SETTLEMENT_OUTBOX_PATH: z.ZodDefault<z.ZodString>;
+    SETTLEMENT_MAX_ATTEMPTS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    SETTLEMENT_TIMEOUT_MS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    SETTLEMENT_DRAIN_INTERVAL_MS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    BUYER_ADDRESS: z.ZodOptional<z.ZodString>;
+    BUYER_PRIVATE_KEY: z.ZodOptional<z.ZodString>;
+    WAYFARER_BUDGET_USDC: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    WAYFARER_TOLL_TOLERANCE_BPS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    WAYFARER_MIN_VALIDITY_SECONDS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    WAYFARER_ALLOW_DOMAINS: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[] | undefined, string | undefined>>;
+    WAYFARER_DENY_DOMAINS: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[] | undefined, string | undefined>>;
+    WAYFARER_PER_DOMAIN_CAP: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    WAYFARER_APPROVAL_USDC: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    WAYFARER_KILL_SWITCH: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<boolean, string>>;
+    OPENAI_API_KEY: z.ZodOptional<z.ZodString>;
+    DEPOSIT_AMOUNT_USDC: z.ZodDefault<z.ZodString>;
+    TOLLGATE_URL: z.ZodOptional<z.ZodString>;
+    CATALOG_URL: z.ZodOptional<z.ZodString>;
+    PUBLISHER_URL: z.ZodOptional<z.ZodString>;
+    RSS_URL: z.ZodOptional<z.ZodString>;
+    SITEMAP_URL: z.ZodOptional<z.ZodString>;
+    WAYFARER_LICENSE_PATH: z.ZodDefault<z.ZodString>;
+    DASHBOARD_PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    DASHBOARD_BIND: z.ZodDefault<z.ZodString>;
+    EVENTS_BACKEND: z.ZodDefault<z.ZodEnum<{
+        jsonl: "jsonl";
+        supabase: "supabase";
+    }>>;
+    NONCE_BACKEND: z.ZodDefault<z.ZodEnum<{
+        supabase: "supabase";
+        memory: "memory";
+    }>>;
+    PENDING_LEGS_BACKEND: z.ZodDefault<z.ZodEnum<{
+        supabase: "supabase";
+        memory: "memory";
+    }>>;
+    SUPABASE_URL: z.ZodOptional<z.ZodString>;
+    SUPABASE_SERVICE_KEY: z.ZodOptional<z.ZodString>;
+    SUPABASE_EVENTS_TABLE: z.ZodDefault<z.ZodString>;
+    SUPABASE_NONCES_TABLE: z.ZodDefault<z.ZodString>;
+    SUPABASE_PENDING_LEGS_TABLE: z.ZodDefault<z.ZodString>;
+    SUPABASE_REVOCATIONS_TABLE: z.ZodDefault<z.ZodString>;
+    OBSERVATIONS_BACKEND: z.ZodDefault<z.ZodEnum<{
+        jsonl: "jsonl";
+        supabase: "supabase";
+        off: "off";
+    }>>;
+    SUPABASE_OBSERVATIONS_TABLE: z.ZodDefault<z.ZodString>;
+    LICENSES_ENABLED: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "true" | "false">>;
+    LICENSE_SIGNING_KEY: z.ZodOptional<z.ZodString>;
+    LICENSE_TTL_SECONDS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    LICENSE_ISSUER: z.ZodOptional<z.ZodString>;
+    LICENSE_PAYEES_MODE: z.ZodDefault<z.ZodEnum<{
+        full: "full";
+        hashed: "hashed";
+    }>>;
+    LICENSE_ONLINE_CHECK: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "true" | "false">>;
+    LICENSE_POP: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "true" | "false">>;
+    LICENSE_POP_WINDOW_SECONDS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    EVENTS_PATH: z.ZodDefault<z.ZodString>;
+    OBSERVATIONS_PATH: z.ZodDefault<z.ZodString>;
+    PAYOUTS_PATH: z.ZodDefault<z.ZodString>;
+    MIN_PAYOUT_USDC: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    PRIMARY_PAYEE_TIEBREAK: z.ZodDefault<z.ZodEnum<{
+        wallet: "wallet";
+        input: "input";
+    }>>;
+    COAUTHOR_ONCHAIN_SPLIT: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "true" | "false">>;
+}, z.core.$strip>;
+export type Config = z.infer<typeof configSchema>;
+export declare function getConfig(): Config;
+/**
+ * Drop the memoized config so the next `getConfig()` re-reads `process.env`.
+ * A test seam for the env-dependent branches the singleton otherwise freezes
+ * (e.g. the Circle-key settlement guard) — not for production hot-reload.
+ */
+export declare function resetConfig(): void;
+/** Assert a set of keys are present (call at a component's boot once it knows what it needs). */
+export declare function requireKeys(cfg: Config, keys: (keyof Config)[]): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2CxB,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqVvB,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAIlD,wBAAgB,SAAS,IAAI,MAAM,CAWlC;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,IAAI,CAElC;AAED,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,EAAE,GAAG,IAAI,CAKrE"}